Skip to content

Select theme

Tools
Cheatsheets
Blog
Metodoloji
Generic Hacking
Web
Active Directory
Windows
Linux
- Linux
- Linux Privilege Escalation
- Linux Privilege Escalation Checklist
- Linux Containers & Escape
- interesting-files-permissions
- containers-namespaces
- linux-basics
  - bypass-linux-restrictions
    Bypass Linux Restrictions
    bypass-fs-protections-read-only-no-exec-distroless
    Bypass FS protections: read-only / no-exec / Distroless
    DDexec / EverythingExec
  - Linux Environment Variables
  - Useful Linux Commands
- user-information
  - interesting-groups-linux-pe
    Interesting Groups - Linux Privesc
    lxd/lxc Group - Privilege escalation
  - euid, ruid, suid
  - Linux Active Directory
  - SSH Forward Agent exploitation
- main-system-information
- network-information
- post-exploitation
  - Linux Post-Exploitation
- processes-crontab-systemd-dbus
  - D-Bus Enumeration & Command Injection Privilege Escalation
  - Payloads to execute
- software-information
macOS
- macOS
- macos-red-teaming
- macos-security-and-privilege-escalation
  - macOS Security & Privilege Escalation
  - mac-os-architecture
    macOS Kernel & System Extensions
    macOS IOKit
    macOS Kernel Extensions & Kernelcache
    macOS Kernel Vulnerabilities
    macOS NVRAM
    macOS System Extensions
  - macos-apps-inspecting-debugging-and-fuzzing
    macOS Apps - Inspecting, debugging and Fuzzing
    Introduction to ARM64v8
    Introduction to x64
    Objects in memory
  - macos-files-folders-and-binaries
    macOS Files, Folders, Binaries & Memory
    macOS Bundles
    macOS Installers Abuse
    macOS Memory Dumping
    macOS Sensitive Locations & Interesting Daemons
    macOS Universal binaries & Mach-O Format
  - macos-proces-abuse
    macOS Process Abuse
    macos-ipc-inter-process-communication
    macOS IPC - Inter Process Communication
    macos-xpc
    macOS XPC
    macos-xpc-connecting-process-check
    macOS XPC Connecting Process Check
    macOS PID Reuse
    macOS xpc_connection_get_audit_token Attack
    macOS XPC Authorization
    macOS MIG - Mach Interface Generator
    macOS Thread Injection via Task port
    macos-library-injection
    macOS Library Injection
    macOS Dyld Hijacking & DYLD_INSERT_LIBRARIES
    macOS Dyld Process
    macOS Automator, Preference Panes & NSServices
    macOS Chromium Injection
    macOS Dirty NIB
    macOS Electron Applications Injection
    macOS Function Hooking
    macOS Java Applications Injection
    macOS .Net Applications Injection
    macOS Perl Applications Injection
    macOS Python Applications Injection
    macOS Quick Look Generators
    macOS Ruby Applications Injection
    macOS XPC Mach Services Abuse
  - macos-security-protections
    macOS Security Protections
    macos-fs-tricks
    macOS FS Tricks
    macOS xattr-acls extra stuff
    macos-sandbox
    macOS Sandbox
    macos-sandbox-debug-and-bypass
    macOS Sandbox Debug & Bypass
    macOS Office Sandbox Bypasses
    macOS Default Sandbox Debug
    macos-tcc
    macOS TCC
    macos-tcc-bypasses
    macOS TCC Bypasses
    macOS Apple Scripts
    macOS Apple Events
    macOS TCC Credential & Data Theft
    macOS TCC Payloads
    macOS - AMFI - AppleMobileFileIntegrity
    macOS Authorizations DB & Authd
    macOS Code Signing
    macOS Code Signing Weaknesses & Sandbox Escapes
    macOS Dangerous Entitlements & TCC perms
    macOS Gatekeeper / Quarantine / XProtect
    macOS Input Monitoring, Screen Capture & Accessibility
    macOS Launch/Environment Constraints & Trust Cache
    macOS MACF - Mandatory Access Control Framework
    macOS Sealed System Volume & DataVault
    macOS SIP
  - macOS AppleFS
  - macOS Objective-C
  - macOS Bypassing Firewalls
  - macOS Defensive Apps
  - Macos Dyld Hijacking And Dyld Insert Libraries
  - macOS File Extension & URL scheme app handlers
  - macOS GCD - Grand Central Dispatch
  - macOS Privilege Escalation
  - macOS Network Services & Protocols
  - macOS Users & External Accounts
- macOS Auto Start
- macOS Useful Commands
Cloud
- Cloud
- AWS — IAM Enumeration & Privilege Escalation
- AWS — S3 Yanlış Yapılandırmaları
- AWS — Metadata (IMDS) & SSRF ile Kimlik Hırsızlığı
- Azure / Entra ID — Enumeration
- Azure — Privilege Escalation & Managed Identity
- GCP — IAM & Metadata Abuse
- Kubernetes Saldırıları
- Container Escape
- AWS — Lambda, SSM & Secrets
- Azure — Storage & Blob Suistimatı
- Microsoft 365 & Entra — Kimlik Saldırıları
- pentesting-ci-cd
  - Ansible Tower / AWX / Automation controller Security
  - apache-airflow-security
    Apache Airflow Security
    Airflow Configuration
    Airflow RBAC
  - Argo CD Security
  - Atlantis Security
  - chef-automate-security
    Check Automate Security
    Chef Automate Enumeration And Attacks
  - CircleCI Security
  - cloudflare-security
    Cloudflare Security
    Cloudflare Domains
    Cloudflare Workers Pass Through Proxy Ip Rotation
    Cloudflare Zero Trust Network
  - concourse-security
    Concourse Security
    Concourse Architecture
    Concourse Enumeration & Attacks
    Concourse Lab Creation
  - Docker Build Context Abuse in Cloud Envs
  - gitblit-security
    Gitblit Security
    Ssh Auth Bypass
  - gitea-security
    Gitea Security
    Basic Gitea Information
  - github-security
    Github Security
    abusing-github-actions
    Abusing Github Actions
    Gh Actions - Artifact Poisoning
    GH Actions - Cache Poisoning
    Gh Actions - Context Script Injections
    GH Actions - npm Supply Chain Abuse
    Accessible Deleted Data in Github
    Basic Github Information
  - gogs-security
    Gogs Security
  - jenkins-security
    Jenkins Security
    Basic Jenkins Information
    Jenkins Arbitrary File Read to RCE via \"Remember Me\"
    Jenkins Dumping Secrets from Groovy
    Jenkins RCE Creating/Modifying Pipeline
    Jenkins RCE Creating/Modifying Project
    Jenkins RCE with Groovy Script
  - okta-security
    Okta Security
    Okta Hardening
  - Pentesting CI/CD Methodology
  - Serverless.com Security
  - Supabase Security
  - teamcity-security
    TeamCity Security
  - Terraform Security
  - TODO
  - travisci-security
    TravisCI Security
    Basic TravisCI Information
  - Vercel Security
- pentesting-cloud
  - aws-security
    AWS Pentesting
    aws-basic-information
    AWS - Basic Information
    AWS - Federation Abuse
    AWS - Permissions for a Pentest
    aws-persistence
    AWS - Persistence
    aws-api-gateway-persistence
    AWS - API Gateway Persistence
    aws-cloudformation-persistence
    AWS - Cloudformation Persistence
    aws-cognito-persistence
    AWS - Cognito Persistence
    aws-dynamodb-persistence
    AWS - DynamoDB Persistence
    aws-ec2-persistence
    AWS - EC2 Persistence
    aws-ec2-replace-root-volume-persistence
    AWS - EC2 ReplaceRootVolume Task (Stealth Backdoor / Persistence)
    aws-ecr-persistence
    AWS - ECR Persistence
    aws-ecs-persistence
    AWS - ECS Persistence
    aws-efs-persistence
    AWS - EFS Persistence
    aws-elastic-beanstalk-persistence
    AWS - Elastic Beanstalk Persistence
    aws-iam-persistence
    AWS - IAM Persistence
    aws-kms-persistence
    AWS - KMS Persistence
    aws-lambda-persistence
    AWS - Lambda Persistence
    AWS - Abusing Lambda Extensions
    AWS - Lambda Alias Version Policy Backdoor
    AWS - Lambda Async Self Loop Persistence
    AWS - Lambda Exec Wrapper Persistence
    AWS - Lambda Layers Persistence
    aws-lightsail-persistence
    AWS - Lightsail Persistence
    aws-rds-persistence
    AWS - RDS Persistence
    aws-s3-persistence
    AWS - S3 Persistence
    aws-sagemaker-persistence
    Aws Sagemaker Persistence
    aws-secrets-manager-persistence
    AWS - Secrets Manager Persistence
    aws-sns-persistence
    AWS - SNS Persistence
    aws-sqs-persistence
    AWS - SQS Persistence
    AWS - SQS DLQ Backdoor Persistence via RedrivePolicy/RedriveAllowPolicy
    AWS - SQS OrgID Policy Backdoor
    aws-ssm-persistence
    AWS - SSM Perssitence
    aws-step-functions-persistence
    AWS - Step Functions Persistence
    aws-sts-persistence
    AWS - STS Persistence
    aws-post-exploitation
    AWS - Post Exploitation
    aws-api-gateway-post-exploitation
    AWS - API Gateway Post Exploitation
    aws-bedrock-post-exploitation
    AWS - Bedrock Post Exploitation
    aws-cloudfront-post-exploitation
    AWS - CloudFront Post Exploitation
    aws-codebuild-post-exploitation
    AWS - CodeBuild Post Exploitation
    AWS Codebuild - Token Leakage
    AWS CodeBuild - Untrusted PR Webhook Bypass (CodeBreach-style)
    aws-control-tower-post-exploitation
    AWS - Control Tower Post Exploitation
    aws-dlm-post-exploitation
    AWS - DLM Post Exploitation
    aws-dynamodb-post-exploitation
    AWS - DynamoDB Post Exploitation
    aws-ec2-ebs-ssm-and-vpc-post-exploitation
    AWS - EC2, EBS, SSM & VPC Post Exploitation
    AWS – Covert Disk Exfiltration via AMI Store-to-S3 (CreateStoreImageTask)
    AWS - Live Data Theft via EBS Multi-Attach
    AWS - EBS Snapshot Dump
    AWS - EC2 Instance Connect Endpoint backdoor + ephemeral SSH key injection
    AWS - Elastic IP Hijack for Ingress/Egress IP Impersonation
    AWS – EC2 ENI Secondary Private IP Hijack (Trust/Allowlist Bypass)
    AWS - Malicious VPC Mirror
    AWS - Security Group Backdoor via Managed Prefix Lists
    AWS – Egress Bypass from Isolated Subnets via VPC Endpoints
    AWS - VPC Flow Logs Cross-Account Exfiltration to S3
    aws-ecr-post-exploitation
    AWS - ECR Post Exploitation
    aws-ecs-post-exploitation
    AWS - ECS Post Exploitation
    aws-efs-post-exploitation
    AWS - EFS Post Exploitation
    aws-eks-post-exploitation
    AWS - EKS Post Exploitation
    aws-elastic-beanstalk-post-exploitation
    AWS - Elastic Beanstalk Post Exploitation
    aws-iam-post-exploitation
    AWS - IAM Post Exploitation
    aws-kms-post-exploitation
    AWS - KMS Post Exploitation
    aws-lambda-post-exploitation
    AWS - Lambda Post Exploitation
    AWS - Lambda EFS Mount Injection
    AWS - Lambda Event Source Mapping Hijack
    AWS - Lambda Function URL Public Exposure
    AWS - Lambda LoggingConfig Redirection
    AWS - Lambda Runtime Pinning Abuse
    AWS - Lambda VPC Egress Bypass
    AWS - Lambda Steal Requests
    aws-lightsail-post-exploitation
    AWS - Lightsail Post Exploitation
    aws-mwaa-post-exploitation
    AWS - MWAA Post Exploitation
    aws-organizations-post-exploitation
    AWS - Organizations Post Exploitation
    aws-rds-post-exploitation
    AWS - RDS Post Exploitation
    aws-s3-post-exploitation
    AWS - S3 Post Exploitation
    aws-sagemaker-post-exploitation
    AWS - SageMaker Post-Exploitation
    Feature Store Poisoning
    aws-secrets-manager-post-exploitation
    AWS - Secrets Manager Post Exploitation
    aws-ses-post-exploitation
    AWS - SES Post Exploitation
    aws-sns-post-exploitation
    AWS - SNS Post Exploitation
    AWS - SNS Message Data Protection Bypass via Policy Downgrade
    SNS FIFO Archive Replay Exfiltration via Attacker SQS FIFO Subscription
    AWS - SNS to Kinesis Firehose Exfiltration (Fanout to S3)
    aws-sqs-post-exploitation
    AWS - SQS Post Exploitation
    AWS – SQS DLQ Redrive Exfiltration via StartMessageMoveTask
    AWS – SQS Cross-/Same-Account Injection via SNS Subscription + Queue Policy
    aws-sso-and-identitystore-post-exploitation
    AWS - SSO & identitystore Post Exploitation
    aws-stepfunctions-post-exploitation
    AWS - Step Functions Post Exploitation
    aws-sts-post-exploitation
    AWS - STS Post Exploitation
    aws-vpn-post-exploitation
    AWS - VPN Post Exploitation
    aws-workmail-post-exploitation
    Readme
    aws-privilege-escalation
    AWS - Privilege Escalation
    aws-apigateway-privesc
    AWS - Apigateway Privesc
    aws-apprunner-privesc
    AWS - AppRunner Privesc
    aws-bedrock-privesc
    AWS - Bedrock Privesc
    aws-chime-privesc
    AWS - Chime Privesc
    aws-cloudformation-privesc
    AWS - Cloudformation Privesc
    iam:PassRole, cloudformation:CreateStack,and cloudformation:DescribeStacks
    aws-cloudfront-privesc
    AWS - CloudFront
    aws-codebuild-privesc
    AWS - Codebuild Privesc
    aws-codepipeline-privesc
    AWS - Codepipeline Privesc
    aws-codestar-privesc
    AWS - Codestar Privesc
    codestar:CreateProject, codestar:AssociateTeamMember
    iam:PassRole, codestar:CreateProject
    aws-cognito-privesc
    AWS - Cognito Privesc
    aws-datapipeline-privesc
    AWS - Datapipeline Privesc
    aws-directory-services-privesc
    AWS - Directory Services Privesc
    aws-dynamodb-privesc
    AWS - DynamoDB Privesc
    aws-ebs-privesc
    AWS - EBS Privesc
    aws-ec2-privesc
    AWS - EC2 Privesc
    aws-ecr-privesc
    AWS - ECR Privesc
    aws-ecs-privesc
    AWS - ECS Privesc
    aws-efs-privesc
    AWS - EFS Privesc
    aws-elastic-beanstalk-privesc
    AWS - Elastic Beanstalk Privesc
    aws-emr-privesc
    AWS - EMR Privesc
    aws-gamelift
    AWS - Gamelift
    aws-glue-privesc
    AWS - Glue Privesc
    aws-iam-privesc
    AWS - IAM Privesc
    aws-kms-privesc
    AWS - KMS Privesc
    aws-lambda-privesc
    AWS - Lambda Privesc
    aws-lightsail-privesc
    AWS - Lightsail Privesc
    aws-macie-privesc
    AWS - Macie Privesc
    aws-mediapackage-privesc
    AWS - Mediapackage Privesc
    aws-mq-privesc
    AWS - MQ Privesc
    aws-msk-privesc
    AWS - MSK Privesc
    aws-organizations-prinvesc
    AWS - Organizations Privesc
    aws-rds-privesc
    AWS - RDS Privesc
    aws-redshift-privesc
    AWS - Redshift Privesc
    aws-s3-privesc
    AWS - S3 Privesc
    aws-sagemaker-privesc
    AWS - Sagemaker Privesc
    aws-secrets-manager-privesc
    AWS - Secrets Manager Privesc
    aws-sns-privesc
    AWS - SNS Privesc
    aws-sqs-privesc
    AWS - SQS Privesc
    aws-ssm-privesc
    AWS - SSM Privesc
    aws-sso-and-identitystore-privesc
    AWS - SSO & identitystore Privesc
    aws-stepfunctions-privesc
    AWS - Step Functions Privesc
    aws-sts-privesc
    AWS - STS Privesc
    aws-workdocs-privesc
    AWS - WorkDocs Privesc
    eventbridgescheduler-privesc
    AWS - EventBridge Scheduler Privesc
    route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertifica
    AWS - Route53 Privesc
    aws-services
    AWS - Services
    AWS - API Gateway Enum
    AWS - Bedrock Enum
    AWS - Certificate Manager (ACM) & Private Certificate Authority (PCA)
    AWS - CloudFormation & Codestar Enum
    AWS - CloudFront Enum
    AWS - CloudHSM Enum
    AWS - Codebuild Enum
    aws-cognito-enum
    AWS - Cognito Enum
    Cognito Identity Pools
    Cognito User Pools
    AWS - DataPipeline, CodePipeline & CodeCommit Enum
    AWS - Directory Services / WorkDocs Enum
    aws-documentdb-enum
    AWS - DocumentDB Enum
    AWS - DynamoDB Enum
    aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum
    AWS - EC2, EBS, ELB, SSM, VPC & VPN Enum
    AWS - Nitro Enum
    AWS - VPC & Networking Basic Information
    AWS - ECR Enum
    AWS - ECS Enum
    AWS - EFS Enum
    AWS - EKS Enum
    AWS - Elastic Beanstalk Enum
    AWS - ElastiCache
    AWS - EMR Enum
    AWS - IAM, Identity Center & SSO Enum
    AWS - Kinesis Data Firehose Enum
    AWS - KMS Enum
    AWS - Lambda Enum
    AWS - Lightsail Enum
    AWS - Macie Enum
    AWS - MQ Enum
    AWS - MSK Enum
    AWS - Organizations Enum
    AWS - Other Services Enum
    AWS - Redshift Enum
    AWS - Relational Database (RDS) Enum
    AWS - Route53 Enum
    AWS - S3, Athena & Glacier Enum
    aws-sagemaker-enum
    AWS - SageMaker Enum
    AWS - Secrets Manager Enum
    aws-security-and-detection-services
    AWS - Security & Detection Services
    AWS - CloudTrail Enum
    AWS - CloudWatch Enum
    AWS - Config Enum
    AWS - Control Tower Enum
    AWS - Cost Explorer Enum
    AWS - Detective Enum
    AWS - Firewall Manager Enum
    AWS - GuardDuty Enum
    AWS - Inspector Enum
    AWS - Security Hub Enum
    AWS - Shield Enum
    AWS - Trusted Advisor Enum
    AWS - WAF Enum
    AWS - SES Enum
    AWS - SNS Enum
    AWS - SQS Enum
    AWS - Step Functions Enum
    AWS - STS Enum
    AWS - EventBridge Scheduler Enum
    aws-unauthenticated-enum-access
    AWS - Unauthenticated Enum & Access
    aws-accounts-unauthenticated-enum
    AWS - Accounts Unauthenticated Enum
    aws-api-gateway-unauthenticated-enum
    AWS - API Gateway Unauthenticated Enum
    aws-cloudfront-unauthenticated-enum
    AWS - Cloudfront Unauthenticated Enum
    aws-codebuild-unauthenticated-access
    AWS - CodeBuild Unauthenticated Access
    aws-cognito-unauthenticated-enum
    AWS - Cognito Unauthenticated Enum
    aws-documentdb-enum
    AWS - DocumentDB Unauthenticated Enum
    aws-dynamodb-unauthenticated-access
    AWS - DynamoDB Unauthenticated Access
    aws-ec2-unauthenticated-enum
    AWS - EC2 Unauthenticated Enum
    aws-ecr-unauthenticated-enum
    AWS - ECR Unauthenticated Enum
    aws-ecs-unauthenticated-enum
    AWS - ECS Unauthenticated Enum
    aws-elastic-beanstalk-unauthenticated-enum
    AWS - Elastic Beanstalk Unauthenticated Enum
    aws-elasticsearch-unauthenticated-enum
    AWS - Elasticsearch Unauthenticated Enum
    aws-iam-and-sts-unauthenticated-enum
    AWS - IAM & STS Unauthenticated Enum
    aws-identity-center-and-sso-unauthenticated-enum
    AWS - Identity Center & SSO Unauthenticated Enum
    aws-iot-unauthenticated-enum
    AWS - IoT Unauthenticated Enum
    aws-kinesis-video-unauthenticated-enum
    AWS - Kinesis Video Unauthenticated Enum
    aws-lambda-unauthenticated-access
    AWS - Lambda Unauthenticated Access
    aws-media-unauthenticated-enum
    AWS - Media Unauthenticated Enum
    aws-mq-unauthenticated-enum
    AWS - MQ Unauthenticated Enum
    aws-msk-unauthenticated-enum
    AWS - MSK Unauthenticated Enum
    aws-rds-unauthenticated-enum
    AWS - RDS Unauthenticated Enum
    aws-redshift-unauthenticated-enum
    AWS - Redshift Unauthenticated Enum
    aws-s3-unauthenticated-enum
    AWS - S3 Unauthenticated Enum
    aws-sagemaker-unauthenticated-enum
    AWS - SageMaker Unauthenticated Enum
    aws-sns-unauthenticated-enum
    AWS - SNS Unauthenticated Enum
    aws-sqs-unauthenticated-enum
    AWS - SQS Unauthenticated Enum
  - azure-security
    Azure Pentesting
    az-basic-information
    Az - Basic Information
    Az Federation Abuse
    Az - Tokens & Public Applications
    Az - Device Registration
    Az - Enumeration Tools
    az-lateral-movement-cloud-on-prem
    Az - Lateral Movement (Cloud - On-Prem)
    Az - Arc vulnerable GPO Deploy Script
    Az - Cloud Kerberos Trust
    Az - Cloud Sync
    Az - Connect Sync
    Az - Domain Services
    Az - Exchange Hybrid Impersonation (ACS Actor Tokens)
    Az - Federation
    Az - Hybrid Identity Misc Attacks
    Az - Local Cloud Credentials
    Az - Pass the Certificate
    Az - Pass the Cookie
    Az - Primary Refresh Token (PRT)
    Az - PTA - Pass-through Authentication
    Az - Seamless SSO
    Az - Permissions for a Pentest
    az-persistence
    Az - Persistence
    Az - Automation Accounts Persistence
    Az - Cloud Shell Persistence
    Az - Logic Apps Persistence
    Az - Queue Storage Persistence
    Az - SQL Persistence
    Az - Storage Persistence
    Az - VMs Persistence
    az-post-exploitation
    Az - Post Exploitation
    Az API Management Post Exploitation
    Az Azure Ai Foundry Post Exploitation
    Az - Blob Storage Post Exploitation
    Az - Container Registry Post Exploitation
    Az - CosmosDB Post Exploitation
    Az - File Share Post Exploitation
    Az - Function Apps Post Exploitation
    Az - Key Vault Post Exploitation
    Az - Logic Apps Post Exploitation
    Az - MySQL Post Exploitation
    Az - PostgreSQL Post Exploitation
    Az - Queue Storage Post Exploitation
    Az - Service Bus Post Exploitation
    Az - SQL Post Exploitation
    Az - Table Storage Post Exploitation
    Az - Virtual Desktop Post Exploitation
    Az - VMs & Network Post Exploitation
    az-privilege-escalation
    Az - Privilege Escalation
    Az - AI Foundry Privesc
    Az - API Management Privesc
    Az - App Services Privesc
    Az - Azure IAM Privesc (Authorization)
    Az - Automation Accounts Privesc
    Az - Container Instances, Apps & Jobs Privesc
    Az - Container Registry Privesc
    Az - CosmosDB Privesc
    az-entraid-privesc
    Az - EntraID Privesc
    Az - Conditional Access Policies & MFA Bypass
    Az - Dynamic Groups Privesc
    Az - Functions App Privesc
    Az - Key Vault Privesc
    Az - Logic Apps Privesc
    Az - MySQL Privesc
    Az - PostgreSQL Privesc
    Az - Queue Storage Privesc
    Az - Service Bus Privesc
    Az - SQL Privesc
    Az - Static Web App Privesc
    Az - Storage Privesc
    Az - Virtual Desktop Privesc
    Az - Virtual Machines & Network Privesc
    az-services
    Az - Services
    Az - ACR
    Az - AI Foundry
    Az - API Management
    Az - Azure App Services
    Az - Application Proxy
    Az - ARM Templates / Deployments
    Az - Automation Accounts
    Az - Entra ID (AzureAD) & Azure IAM
    Az - Cloud Shell
    Az - Container Instances, Apps & Jobs
    Az - Container Registry
    Az - CosmosDB
    Az - Defender
    Az - File Shares
    Az - Front Door
    Az - Function Apps
    Az - Key Vault
    Az - Logic Apps
    Az - Management Groups, Subscriptions & Resource Groups
    Az - Misc
    Az - Monitoring
    Az - MySQL
    Az - PostgreSQL
    Az - Queue Storage
    Az - Sentinel
    Az - Service Bus
    Az - SQL
    Az - Static Web Applications
    Az - Storage Accounts & Blobs
    Az - Table Storage
    Az - Virtual Desktop
    Az - Intune
    vms
    Az - Virtual Machines & Network
    Az - Azure Network
    az-unauthenticated-enum-and-initial-entry
    Az - Unauthenticated Enum & Initial Entry
    Az - Container Registry Unauth
    Az - Device Code Authentication Phishing
    Az - Monitor Alert Phishing
    Az - OAuth Apps Phishing
    Az - Password Spraying
    Az - Storage Unauth
    Az - VMs Unauth
  - confidential-computing
    Luks2 Header Malleability Null Cipher Abuse
  - digital-ocean-pentesting
    Digital Ocean Pentesting
    DO - Basic Information
    DO - Permissions for a Pentest
    do-services
    DO - Services
    DO - Apps
    DO - Container Registry
    DO - Databases
    DO - Droplets
    DO - Functions
    DO - Images
    DO - Kubernetes (DOKS)
    DO - Networking
    DO - Projects
    DO - Spaces
    DO - Volumes
  - gcp-security
    GCP Pentesting
    gcp-basic-information
    GCP - Basic Information
    GCP - Federation Abuse
    GCP - Permissions for a Pentest
    gcp-persistence
    GCP - Persistence
    GCP - API Keys Persistence
    GCP - App Engine Persistence
    GCP - Artifact Registry Persistence
    GCP - BigQuery Persistence
    GCP - Bigtable Persistence
    GCP - Cloud Functions Persistence
    GCP - Cloud Run Persistence
    GCP - Cloud Shell Persistence
    GCP - Cloud SQL Persistence
    GCP - Compute Persistence
    GCP - Dataflow Persistence
    GCP - Filestore Persistence
    GCP - Logging Persistence
    GCP - Token Persistence
    GCP - Secret Manager Persistence
    GCP - Storage Persistence
    gcp-post-exploitation
    GCP - Post Exploitation
    GCP - Apigee Post Exploitation
    GCP - App Engine Post Exploitation
    GCP - Artifact Registry Post Exploitation
    GCP - Bigtable Post Exploitation
    GCP - Cloud Build Post Exploitation
    GCP - Cloud Functions Post Exploitation
    GCP - Cloud Run Post Exploitation
    GCP - Cloud Shell Post Exploitation
    GCP - Cloud SQL Post Exploitation
    GCP - Compute Post Exploitation
    GCP - Dataflow Post Exploitation
    GCP - Filestore Post Exploitation
    GCP - IAM Post Exploitation
    GCP - KMS Post Exploitation
    GCP - Logging Post Exploitation
    GCP - Monitoring Post Exploitation
    GCP - Pub/Sub Post Exploitation
    GCP - Secretmanager Post Exploitation
    GCP - Security Post Exploitation
    GCP - Storage Post Exploitation
    GCP - Vertex AI Post Exploitation
    GCP - Workflows Post Exploitation
    gcp-privilege-escalation
    GCP - Privilege Escalation
    GCP - Apikeys Privesc
    GCP - AppEngine Privesc
    GCP - Artifact Registry Privesc
    GCP - Batch Privesc
    GCP - BigQuery Privesc
    GCP - Bigtable Privesc
    GCP - ClientAuthConfig Privesc
    GCP - Cloud Workstations Privesc
    GCP - Cloudbuild Privesc
    GCP - Cloudfunctions Privesc
    GCP - Cloudidentity Privesc
    GCP - Cloud Scheduler Privesc
    GCP - Cloud Tasks Privesc
    GCP - Composer Privesc
    gcp-compute-privesc
    GCP - Compute Privesc
    GCP - Add Custom SSH Metadata
    GCP - Container Privesc
    GCP - Dataflow Privesc
    GCP - Dataproc Privesc
    GCP - Deploymentmaneger Privesc
    GCP - Firebase Privesc
    GCP - IAM Privesc
    GCP - KMS Privesc
    GCP - local privilege escalation ssh pivoting
    GCP - Generic Permissions Privesc
    GCP - Network Docker Escape
    GCP - Orgpolicy Privesc
    GCP - Pubsub Privesc
    GCP - Resourcemanager Privesc
    GCP - Run Privesc
    GCP - Secretmanager Privesc
    GCP - Serviceusage Privesc
    GCP - Sourcerepos Privesc
    GCP - Storage Privesc
    GCP - Vertex AI Privesc
    GCP - Workflows Privesc
    gcp-services
    GCP - Services
    GCP - AI Platform Enum
    GCP - API Keys Enum
    GCP - App Engine Enum
    GCP - Artifact Registry Enum
    GCP - Batch Enum
    GCP - Bigquery Enum
    GCP - Bigtable Enum
    GCP - Cloud Build Enum
    GCP - Cloud Functions Enum
    GCP - Cloud Run Enum
    GCP - Cloud Scheduler Enum
    GCP - Cloud Shell Enum
    GCP - Cloud SQL Enum
    GCP - Composer Enum
    gcp-compute-instances-enum
    GCP - Compute Enum
    GCP - Compute Instances
    GCP - VPC & Networking
    GCP - Containers & GKE Enum
    GCP - Dataflow Enum
    GCP - Dataproc Enum
    GCP - DNS Enum
    GCP - Filestore Enum
    GCP - Firebase Enum
    GCP - Firestore Enum
    GCP - IAM, Principals & Org Policies Enum
    GCP - KMS Enum
    GCP - Logging Enum
    GCP - Memorystore Enum
    GCP - Monitoring Enum
    GCP - Pub/Sub Enum
    GCP - Secrets Manager Enum
    GCP - Security Enum
    GCP - Source Repositories Enum
    GCP - Spanner Enum
    GCP - Stackdriver Enum
    GCP - Storage Enum
    GCP - Vertex AI Enum
    GCP - Workflows Enum
    gcp-to-workspace-pivoting
    GCP (--) Workspace Pivoting
    GCP - Understanding Domain-Wide Delegation
    gcp-unauthenticated-enum-and-access
    GCP - Unauthenticated Enum & Access
    GCP - API Keys Unauthenticated Enum
    GCP - App Engine Unauthenticated Enum
    GCP - Artifact Registry Unauthenticated Enum
    GCP - Cloud Build Unauthenticated Enum
    GCP - Cloud Functions Unauthenticated Enum
    GCP - Cloud Run Unauthenticated Enum
    GCP - Cloud SQL Unauthenticated Enum
    GCP - Compute Unauthenticated Enum
    GCP - IAM, Principals & Org Unauthenticated Enum
    GCP - Source Repositories Unauthenticated Enum
    gcp-storage-unauthenticated-enum
    GCP - Storage Unauthenticated Enum
    GCP - Public Buckets Privilege Escalation
  - ibm-cloud-pentesting
    IBM Cloud Pentesting
    IBM - Basic Information
    IBM - Hyper Protect Crypto Services
    IBM - Hyper Protect Virtual Server
  - kubernetes-security
    Kubernetes Pentesting
    abusing-roles-clusterroles-in-kubernetes
    Abusing Roles/ClusterRoles in Kubernetes
    Kubernetes Roles Abuse Lab
    Pod Escape Privileges
    Attacking Kubernetes from inside a Pod
    Exposing Services in Kubernetes
    Kubernetes Basics
    Kubernetes Enumeration
    Kubernetes External Secret Operator
    kubernetes-hardening
    Kubernetes Hardening
    Kubernetes SecurityContext(s)
    kubernetes-kyverno
    Kubernetes Kyverno
    Kubernetes Kyverno bypass
    Kubernetes Namespace Escalation
    Kubernetes Network Attacks
    kubernetes-opa-gatekeeper
    Kubernetes OPA Gatekeeper
    Kubernetes OPA Gatekeeper bypass
    Kubernetes Pivoting to Clouds
    Kubernetes Role-Based Access Control(RBAC)
    Kubernetes ValidatingWebhookConfiguration
    pentesting-kubernetes-services
    Pentesting Kubernetes Services
    Kubelet Authentication & Authorization
  - openshift-pentesting
    OpenShift Pentesting
    OpenShift - Basic information
    openshift-jenkins
    OpenShift - Jenkins
    OpenShift - Jenkins Build Pod Override
    openshift-privilege-escalation
    OpenShift - Privilege Escalation
    OpenShift - Missing Service Account
    OpenShift - SCC bypass
    OpenShift - Tekton
    Openshift - SCC
  - Pentesting Cloud Methodology
  - workspace-security
    GWS - Workspace Pentesting
    gws-google-platforms-phishing
    GWS - Google Platforms Phishing
    GWS - App Scripts
    GWS - Persistence
    GWS - Post Exploitation
    gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid
    GWS - Workspace Sync Attacks (GCPW, GCDS, GPS, Directory Sync with AD & EntraID)
    GCDS - Google Cloud Directory Sync
    GCPW - Google Credential Provider for Windows
    GPS - Google Password Sync
    GWS - Admin Directory Sync
Network
Mobile
WiFi
AI
Binary Exploitation
- Binary Exploitation
- Bellek korumaları & bypass
- stack-overflow
  - Stack Buffer Overflow
  - ret2win
    Ret2win
    Ret2win - arm64
  - stack-shellcode
    Stack Shellcode
    Stack Shellcode - arm64
  - Pointer Redirecting
  - Stack Pivoting
  - Uninitialized Variables
  - Windows SEH Overflow
- Return-Oriented Programming (ROP)
- Format String
- Shellcode & ret2shellcode
- GOT Overwrite & ret2plt
- arbitrary-write-2-exec
- basic-stack-binary-exploitation-methodology
- common-binary-protections-and-bypasses
- format-strings
- Integer Overflow & Off-by-One
- ios-exploiting
- libc-heap
- rop-return-oriented-programing
  - ROP & JOP
  - ret2lib
    Ret2lib
    rop-leaking-libc-address
    Leaking libc address with ROP
    Leaking libc - template
    One Gadget
    Ret2lib + Printf leak - arm64
  - rop-syscall-execv
    Ret2syscall
    Ret2syscall - arm64
  - srop-sigreturn-oriented-programming
    SROP - Sigreturn-Oriented Programming
    SROP - arm64
  - BROP - Blind Return Oriented Programming
  - Ret2csu
  - Ret2dlresolve
  - Ret2esp / Ret2reg
  - Ret2vDSO
- Array Indexing
- Chrome Exploiting
- Common Exploiting Problems
- Common Exploiting Problems Unsafe Relocation Fixups
- firmware-analysis
  - Mediatek Xflash Carbonara Da2 Hash Bypass
  - Synology Encrypted Archive Decryption
- PS5 compromission
- Heap Exploitation
- linux-kernel-exploitation
- ret2libc
- Araçlar: GDB, pwntools, checksec
- Vmware Workstation Pvscsi Lfh Escape
- Windows Exploiting (Basic Guide - OSCP lvl)
- Windows Vectored Overloading
Hardware
Reversing
- Reversing
- Statik Analiz
- Dinamik Analiz
- Unpacking
- Common API used in Malware
- reversing-tools-basic-methods
- Word Macros
Crypto
Steganography
- Steganography
- stego

Select theme

On this page

Overview
Konu başlıkları

On this page

Overview
Konu başlıkları

Generic Hacking

generic

Dayanak kurulumu ve taşıma katmanı: shell, TTY, tünel, exfiltration ve exploit arama.

Konu başlıkları

Section titled “Konu başlıkları”

Archive Extraction Path Traversal
Brute Force - CheatSheet
Esim Javacard Exploitation
Exfiltration
Expose local to the internet
Full TTYs
Reverse Shells (Linux, Windows, MSFVenom)
Reverse Shells - Linux
MSFVenom - CheatSheet
Reverse Shells - Windows
Search Exploits
Tunneling and Port Forwarding

Previous
Threat Modeling Next
Reverse Shells (Linux, Windows, MSFVenom)